Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Detect integers 6444 v1 #10089

Closed
wants to merge 2 commits into from
Closed

Detect integers 6444 v1 #10089

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f01161f
detect: integer keywords now support hexadecimal
catenacyber Dec 1, 2023
aa0d56e
detect: integer keywords now accept negated ranges
catenacyber Nov 30, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
99 changes: 90 additions & 9 deletions rust/src/detect/uint.rs
View file
Open in desktop
Expand Up @@ -17,7 +17,7 @@

use nom7::branch::alt;
use nom7::bytes::complete::{is_a, tag, tag_no_case, take_while};
use nom7::character::complete::digit1;
use nom7::character::complete::{char, digit1, hex_digit1};
use nom7::combinator::{all_consuming, map_opt, opt, value, verify};
use nom7::error::{make_error, ErrorKind};
use nom7::Err;
Expand All @@ -35,6 +35,7 @@ pub enum DetectUintMode {
DetectUintModeGte,
DetectUintModeRange,
DetectUintModeNe,
DetectUintModeNegRg,
}

#[derive(Debug)]
Expand Down Expand Up @@ -73,8 +74,25 @@ pub fn detect_parse_uint_unit(i: &str) -> IResult<&str, u64> {
return Ok((i, unit));
}

pub fn detect_parse_uint_value_hex<T: DetectIntType>(i: &str) -> IResult<&str, T> {
let (i, _) = tag("0x")(i)?;
let (i, arg1s) = hex_digit1(i)?;
match T::from_str_radix(arg1s, 16) {
Ok(arg1) => Ok((i, arg1)),
_ => Err(Err::Error(make_error(i, ErrorKind::Verify))),
}
}

pub fn detect_parse_uint_value<T: DetectIntType>(i: &str) -> IResult<&str, T> {
let (i, arg1) = alt((
detect_parse_uint_value_hex,
map_opt(digit1, |s: &str| s.parse::<T>().ok()),
))(i)?;
Ok((i, arg1))
}

pub fn detect_parse_uint_with_unit<T: DetectIntType>(i: &str) -> IResult<&str, T> {
let (i, arg1) = map_opt(digit1, |s: &str| s.parse::<T>().ok())(i)?;
let (i, arg1) = detect_parse_uint_value::<T>(i)?;
let (i, unit) = opt(detect_parse_uint_unit)(i)?;
if arg1 >= T::one() {
if let Some(u) = unit {
Expand Down Expand Up @@ -107,41 +125,53 @@ pub fn detect_parse_uint_start_equal<T: DetectIntType>(
pub fn detect_parse_uint_start_interval<T: DetectIntType>(
i: &str,
) -> IResult<&str, DetectUintData<T>> {
let (i, arg1) = map_opt(digit1, |s: &str| s.parse::<T>().ok())(i)?;
let (i, neg) = opt(char('!'))(i)?;
let (i, arg1) = detect_parse_uint_value(i)?;
let (i, _) = opt(is_a(" "))(i)?;
let (i, _) = alt((tag("-"), tag("<>")))(i)?;
let (i, _) = opt(is_a(" "))(i)?;
let (i, arg2) = verify(map_opt(digit1, |s: &str| s.parse::<T>().ok()), |x| {
let (i, arg2) = verify(detect_parse_uint_value, |x| {
x > &arg1 && *x - arg1 > T::one()
})(i)?;
let mode = if neg.is_some() {
DetectUintMode::DetectUintModeNegRg
} else {
DetectUintMode::DetectUintModeRange
};
Ok((
i,
DetectUintData {
arg1,
arg2,
mode: DetectUintMode::DetectUintModeRange,
mode,
},
))
}

fn detect_parse_uint_start_interval_inclusive<T: DetectIntType>(
i: &str,
) -> IResult<&str, DetectUintData<T>> {
let (i, arg1) = verify(map_opt(digit1, |s: &str| s.parse::<T>().ok()), |x| {
let (i, neg) = opt(char('!'))(i)?;
let (i, arg1) = verify(detect_parse_uint_value::<T>, |x| {
*x > T::min_value()
})(i)?;
let (i, _) = opt(is_a(" "))(i)?;
let (i, _) = alt((tag("-"), tag("<>")))(i)?;
let (i, _) = opt(is_a(" "))(i)?;
let (i, arg2) = verify(map_opt(digit1, |s: &str| s.parse::<T>().ok()), |x| {
let (i, arg2) = verify(detect_parse_uint_value::<T>, |x| {
*x > arg1 && *x < T::max_value()
})(i)?;
let mode = if neg.is_some() {
DetectUintMode::DetectUintModeNegRg
} else {
DetectUintMode::DetectUintModeRange
};
Ok((
i,
DetectUintData {
arg1: arg1 - T::one(),
arg2: arg2 + T::one(),
mode: DetectUintMode::DetectUintModeRange,
mode,
},
))
}
Expand All @@ -162,7 +192,7 @@ pub fn detect_parse_uint_mode(i: &str) -> IResult<&str, DetectUintMode> {
fn detect_parse_uint_start_symbol<T: DetectIntType>(i: &str) -> IResult<&str, DetectUintData<T>> {
let (i, mode) = detect_parse_uint_mode(i)?;
let (i, _) = opt(is_a(" "))(i)?;
let (i, arg1) = map_opt(digit1, |s: &str| s.parse::<T>().ok())(i)?;
let (i, arg1) = detect_parse_uint_value(i)?;

match mode {
DetectUintMode::DetectUintModeNe => {}
Expand Down Expand Up @@ -238,6 +268,11 @@ pub fn detect_match_uint<T: DetectIntType>(x: &DetectUintData<T>, val: T) -> boo
return true;
}
}
DetectUintMode::DetectUintModeNegRg => {
if val <= x.arg1 || val >= x.arg2 {
return true;
}
}
}
return false;
}
Expand Down Expand Up @@ -407,6 +442,52 @@ pub unsafe extern "C" fn rs_detect_u16_free(ctx: &mut DetectUintData<u16>) {
mod tests {
use super::*;

#[test]
fn test_parse_uint_hex() {
match detect_parse_uint::<u64>("0x100") {
Ok((_, val)) => {
assert_eq!(val.arg1, 0x100);
}
Err(_) => {
assert!(false);
}
}
match detect_parse_uint::<u8>("0xFF") {
Ok((_, val)) => {
assert_eq!(val.arg1, 255);
}
Err(_) => {
assert!(false);
}
}
match detect_parse_uint::<u8>("0xff") {
Ok((_, val)) => {
assert_eq!(val.arg1, 255);
}
Err(_) => {
assert!(false);
}
}
}

#[test]
fn test_parse_uint_negated_range() {
match detect_parse_uint::<u8>("!1-6") {
Ok((_, val)) => {
assert_eq!(val.arg1, 1);
assert_eq!(val.arg2, 6);
assert_eq!(val.mode, DetectUintMode::DetectUintModeNegRg);
assert!(detect_match_uint(&val, 1));
assert!(!detect_match_uint(&val, 2));
assert!(!detect_match_uint(&val, 5));
assert!(detect_match_uint(&val, 6));
}
Err(_) => {
assert!(false);
}
}
}

#[test]
fn test_parse_uint_unit() {
match detect_parse_uint::<u64>(" 2kb") {
Expand Down